CVE-2026-26308: Envoyproxy Envoy Auth Bypass Vulnerability

CVE-2026-26308 Overview

CVE-2026-26308 is an Authorization Bypass vulnerability affecting Envoy, a high-performance edge/middle/service proxy. The vulnerability exists in Envoy's RBAC (Role-Based Access Control) filter, which contains a logic flaw in how it validates HTTP headers when multiple values are present for the same header name. Instead of validating each header value individually, Envoy concatenates all values into a single comma-separated string, enabling attackers to bypass security policies.

Critical Impact

This vulnerability allows attackers to bypass RBAC "Deny" rules by sending duplicate HTTP headers, effectively obscuring malicious values from exact-match mechanisms and gaining unauthorized access to protected resources.

Affected Products

• Envoy versions prior to 1.34.13
• Envoy versions prior to 1.35.8
• Envoy versions prior to 1.36.5
• Envoy version 1.37.0 (prior to 1.37.1)

Discovery Timeline

• 2026-03-10 - CVE-2026-26308 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-26308

Vulnerability Analysis

The vulnerability stems from improper authorization logic (CWE-863) in Envoy's RBAC filter component. When processing HTTP requests containing duplicate headers with the same name, Envoy's header matching logic concatenates all values into a single comma-separated string before performing RBAC policy evaluation. This design flaw undermines the effectiveness of exact-match deny rules, as the concatenated string will never match a single blocked value.

For example, if an RBAC policy denies requests with an X-Custom-Header: malicious, an attacker could send a request with two X-Custom-Header values: benign and malicious. Envoy would concatenate these into benign,malicious, which would not match the exact "malicious" string, allowing the request to bypass the deny rule.

Root Cause

The root cause is the absence of individual header value validation in the RBAC filter's header matching implementation. The original code only implemented a matchesHeaders() method that operated on concatenated header values, rather than iterating through and validating each header value separately against RBAC policies.

Attack Vector

An attacker can exploit this vulnerability remotely over the network without authentication. The attack involves crafting HTTP requests with duplicate header names, where one value is benign and another contains the payload or value that should be blocked by RBAC policies. Since Envoy concatenates these values before evaluation, the exact-match deny rules fail to detect the malicious value embedded within the comma-separated string. This provides unauthorized access to endpoints that should be protected.

// Security patch introducing individual header value matching
// Source: https://github.com/envoyproxy/envoy/commit/b6ba0b2294b98484fb0ed8556897d1073cc27867

   * Check whether header matcher matches any headers in a given HeaderMap.
   */
  virtual bool matchesHeaders(const HeaderMap& headers) const PURE;
+
+  /**
+   * Matches headers validating each value individually.
+   */
+  virtual bool matchesHeadersIndividually(const HeaderMap& headers) const PURE;
};

using HeaderMatcherSharedPtr = std::shared_ptr<HeaderMatcher>;

The patch introduces a new matchesHeadersIndividually() method that validates each header value separately, preventing the concatenation bypass technique.

Detection Methods for CVE-2026-26308

Indicators of Compromise

• HTTP requests containing duplicate headers with identical names targeting RBAC-protected endpoints
• Access logs showing successful requests to restricted resources with unusual header patterns
• Anomalous patterns where denied header values appear as substrings within comma-separated values

Detection Strategies

• Implement deep packet inspection to identify requests with duplicate HTTP headers targeting sensitive endpoints
• Configure WAF rules to detect and flag requests containing multiple instances of the same custom header
• Monitor Envoy access logs for successful requests to RBAC-protected resources that should have been denied
• Deploy SentinelOne Singularity to detect anomalous network traffic patterns indicative of RBAC bypass attempts

Monitoring Recommendations

• Enable verbose logging on Envoy RBAC filter to capture header evaluation decisions
• Set up alerts for requests containing duplicate headers in security-sensitive contexts
• Implement network monitoring to detect reconnaissance or exploitation attempts targeting header manipulation

How to Mitigate CVE-2026-26308

Immediate Actions Required

• Upgrade Envoy to patched versions 1.37.1, 1.36.5, 1.35.8, or 1.34.13 immediately
• Review and audit existing RBAC policies for exact-match rules that may have been bypassed
• Examine access logs for evidence of exploitation using duplicate header techniques
• Consider temporarily implementing additional upstream filtering for critical endpoints

Patch Information

Envoyproxy has released security patches addressing this vulnerability. The fix introduces a new matchesHeadersIndividually() method that validates each header value separately rather than operating on concatenated strings. Patched versions include 1.37.1, 1.36.5, 1.35.8, and 1.34.13. The specific commit addressing this issue is available in the GitHub Commit Update. For full details, refer to the GitHub Security Advisory.

Workarounds

• Implement prefix or suffix matching rules instead of exact-match rules where possible
• Deploy an upstream WAF or proxy that normalizes duplicate headers before they reach Envoy
• Use regex-based RBAC rules that can match substrings within concatenated values as a temporary measure
• Consider implementing additional application-layer authorization as a defense-in-depth control

# Verify current Envoy version and upgrade
envoy --version

# Upgrade to patched version (example using Docker)
docker pull envoyproxy/envoy:v1.37.1

# Restart Envoy service with patched version
systemctl restart envoy